DetailPage-MSS-KB

Microsoft small business knowledge base

Article ID: 291824 - Last Review: October 6, 2011 - Revision: 9.0

This article was previously published under Q291824

On This Page

SUMMARY

This article describes what macro viruses are, what to do if you think your computer might have a Word macro virus, and how to ensure that your documents do not become infected with a macro virus.

MORE INFORMATION

The first macro virus was discovered in the summer of 1995. Since that time, other macro viruses have appeared.

A macro virus is a malicious program that is written by using the macro language of a program such as Word. The virus propagates itself among data files and can harm your files or your computer's operating system.

Word macro viruses do not travel freely over the Internet or any other media; they can only be transferred when a user opens a document or template that contains the macro virus.

Macro viruses cannot be transferred by e-mail, unless an affected document is embedded in the e-mail message and the receiver opens the document.

Symptoms of a Macro Virus

The following are some symptoms of Word macro viruses that are known to affect Word and Word documents:
  • When you try to save a document, Word only lets you save the document as a template.

    -or-
  • The icon for the file looks like a template rather than a document.

    -or-
  • When you open a document, a dialog box showing the number 1 appears.

    -or-
  • The Macro and Customize commands no longer appear on the Tools menu.

    -or-
  • New macros appear in the list of macros. AutoOpen and FileSaveAs macros may also appear; if you already had macros by these names, their content may be modified by the macro virus.

    -or-
  • Unusual or unexpected messages appear when you open a Word document or template.
Notes
  • Word does not look for macro viruses or remove any macro viruses from existing documents and templates. It only warns you if the document that you are opening contains macros. Then you can either open the document with the macros active or open it with the macros disabled. You should not open a document with the macros active, unless you are absolutely sure that the document contains no harmful macro viruses.
  • Third-party antivirus programs must be updated frequently to remain effective. Contact the vendor for update information.

Install an antivirus program

For a long-term solution to macro viruses, install antivirus software that is specifically designed to detect macro viruses. For additional information about antivirus software vendors, including software capable of detecting and preventing macro viruses, click the following article number to view the article in the Microsoft Knowledge Base:
49500  (http://support.microsoft.com/kb/49500/ ) List of antivirus software vendors
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

What to do when you think your computer might have a macro virus

Use the following methods as temporary solutions only when you think your computer might have a macro virus.

Method 1: Disable the macros and copy the text into a new document

If you do not experience any of the symptoms described earlier in this article, but you do not want to be affected by a macro virus, hold down the SHIFT key when you open a file that might be infected by a macro virus. Pressing SHIFT prevents any Word Auto macros from running; if a macro virus is present, it is not loaded.

Method 2: Delete the macro and recover the document

If you experience the symptoms described earlier in this article, or if you suspect that you have a macro virus that is not described in this article, follow these steps to delete the suspect macro and to correct affected document.

Note This is only a temporary solution; because new macros are being created, these steps may not work on new macros.
  1. On the menu, click Word then click Quit. Move the Normal file to Desktop. To do this:
    1. Exit all Microsoft programs.
    2. On the Finder menu, click Go select Home .
    3. Open the  Library  folder.
    4. Open the  Application Support  folder.
    5. Open the  Microsoft folder .  
    6. Open the Office folder.  
    7. Open the User Templates folder.  
    8. Right-click Normal file. Click Edit then choose Copy "Normal.dotm".

  2. Open Word. On the File menu, click Open.
  3. Navigate to the folder that contains the affected file.
  4. Click to select the affected file. Immediately press and hold the SHIFT key and then click Open. Continue holding the SHIFT key until the affected file is open in Word.

    Note Holding the SHIFT key while opening a file prevents any Word Auto macros from running.
  5. To delete a suspect macro, use the following steps:
    1. On the Tools menu, point to Macro, and then click Macros.
    2. In the Macros In pop-up menu, select All Active Templates and Documents.
    3. Select the suspect macro, and then click Delete. Click Yes when prompted whether you want to delete the macro.
    4. Repeat step c for all suspect macros.
    5. Click Cancel to close the Macro dialog box.
  6. To recover the text of an infected document, follow these steps:
    1. Select the entire document by pressing COMMAND+A or by clicking Select All on the Edit menu.
    2. Delete the last paragraph mark of the document from the selection by pressing SHIFT+LEFT ARROW.
    3. On the Edit menu, click Copy.
    4. On the File menu, click New. Select the template that you want to use, and then click OK.
    5. On the Edit menu, click Paste.
    6. Repeat step 7 to ensure that the virus-containing macro has not replicated.
    7. Save the document.
  7. Repeat these steps for any document that you suspect might contain a macro virus.
Note If method 2 does not work, try method 3.

Method 3: Use the Organizer to temporarily clean up a macro virus

Use the Organizer to clean up the macro virus. Keep in mind that if you open other files after you open the infected file, these files most likely are infected as well.

To remove the virus from the Normal template, follow these steps:
  1. Close all documents. If an infected document is open, it can easily re-infect the Normal template.
  2. On the Tools menu, click Templates and Add-Ins, and then click the Organizer button.
  3. Click the Macro Project Items tab, and then rename or delete all of the following macros:
    • NewMacros
    • AutoClose
    • AutoExec
    • AutoOpen
    • FileExit
    • FileNew
    • FileOpen
    • FileSave
    • FileSaveAs
    • Macros
    • ToolsMacro
  4. Click Close.
  5. Press and hold SHIFT while you click Save All on the File menu to save the template.
To remove a macro virus from an infected document:

If a file is infected, use the same method as in steps 1 through 5, but remove the macros from both the Normal template and also from the infected document (template) while in the Organizer. When you are finished, press and hold SHIFT while you click Save All on the File menu, and then move to the next file. Keep in mind that every time you open an infected file, it infects your Normal template, so you must repeatedly remove the macros from the Normal template.

Method 4: Insert the infected file into a new document

This method is particularly useful with the "CAP" macro virus, which removes Macro and Customize from the Tools menu.

Note In this situation, Templates and Add-Ins on the Tools menu may not work.
  1. On the menu, click Word then click Quit. Move the Normal template to the desktop. To do this:
    1. Exit all Microsoft programs.
    2. On the Finder menu, click Go select Home .
    3. Open the  Library  folder.
    4. Open the  Application Support  folder.
    5. Open the  Microsoft folder .  
    6. Open the Office folder.  
    7. Open the User Templates folder.  
    8. Right-click Normal file. Click Edit then choose Copy "Normal.dotm". 

  2. Open Word and then verify that Macro and Customize appear on the Tools menu.
  3. Open a new document. On the Insert menu, click File.
  4. Navigate to the folder containing the affected file.
  5. Click to select the affected file.
  6. Press and hold the SHIFT key and then click Open. Continue to hold the SHIFT key until the affected file is open in Word.
    Note Holding the SHIFT key while opening a file prevents Word Auto macros from running.
  7. To verify whether any macros exist in the new document (none should be listed), point to Macro on the Tools menu, and then click Macros. In the Macros In pop-up list, click All active templates and documents. Under Macro Name, no macros should be listed. Click Cancel.
  8. Save the file with a different file name.
  9. Delete the infected file.

Method 5: Use the RTF workaround 

A. Delete the Normal (Global Template) file.

This is an issue with a macro being saved to your Normal template.

The following steps remove the Normal template. Be aware that any special formatting set in the Normal template will be removed, and the template will be reset to the default settings.
  1. Exit all Microsoft programs.
  2. On the Finder menu, click Go select Home .
  3. Open the  Library  folder.
  4. Open the  Application Support  folder.
  5. Open the  Microsoft folder .
  6. Open the Office folder.
  7. Open the User Templates folder.
  8. Locate the file that is named Normal. Click File and click Move to Trash.

B. Disable the macros.

Open the virus files, and then disable the macros on each file as you receive the Macro warning. If you don't get a warning, you need to turn on macro warnings. To do this, follow these steps:
  1. On the Word menu, and click Preferences.
  2. In the navigation pane, click Security, and then select the Warn before opening a file that contains macros check box.

C. Resave the existing files.

  1. Click Save As on the File menu.
  2. In the Format list, click Rich Text Format (RTF).
  3. Click Save.

After you have saved the file as an RTF file, save the document in the Word (.doc) format again and overwrite the file that has the Macro virus or save the document as a new file, and then delete the old file that contains the virus. After you resave the new file in .doc format, you can delete the RTF file. Keep in mind that some formatting elements may not be retained in the transition from the Word (.doc) format to RTF.



APPLIES TO
  • Microsoft Word for Mac 2011
  • Microsoft Word 2004 for Mac
Keywords: 
dftsdahomeportal kbinfo KB291824
Share
Additional support options
Ask The Microsoft Small Business Support Community
Contact Microsoft Small Business Support
Find Microsoft Small Business Support Certified Partner
Find a Microsoft Store For In-Person Small Business Support